core/cli: hand the trash switch to the tools

`[trash] enabled` now reaches `delete_path` through the bound instance's
workspace policy, the same channel `[agent] path_denylist` already travels: set
when the session state is built and re-read by `reload_config_from_disk`, so a
config reload in the middle of a chat changes the next delete too.

The policy flag is what `delete_path` consults, so a host that never sets it
gets the safe default (deletes go to the trash) instead of a silent no-op.

tests/test_tools/test_fs_ops.py

@@ -5,6 +5,7 @@ from pathlib import Path
 import pytest
 
 from plyngent.tools.file import copy_path, delete_path, fs_ops, move_path, read_file, write_file
+from plyngent.tools.workspace import set_trash_enabled
 from tests.test_tools.helpers import call_sync
 
 
@@ -169,3 +170,16 @@ def test_permanent_delete_skips_the_trash(workspace: object, monkeypatch: pytest
 
     assert out == "deleted file t.txt"
     assert not (workspace / "t.txt").exists()
+
+
+def test_the_host_switch_turns_the_trash_off(workspace: object, monkeypatch: pytest.MonkeyPatch) -> None:
+    """``[trash] enabled = false`` restores the behaviour from before the trash."""
+    assert isinstance(workspace, Path)
+    _elsewhere_than_temp(monkeypatch)
+    set_trash_enabled(enabled=False)
+    _ = call_sync(write_file, "t.txt", "x")
+
+    out = call_sync(delete_path, "t.txt")
+
+    assert out == "deleted file t.txt"
+    assert not (workspace / "t.txt").exists()